The Tribal WordPress plugin contains a flaw that permits sensitive information to be inserted into data transmitted by the plugin. This allows an attacker to retrieve embedded confidential data managed by the plugin, thereby exposing private information that the site may handle.

Any WordPress site that has the Tribal plugin installed with a version through 1.3.4 is affected. The vulnerability applies to all releases from the initial availability up to and including version 1.3.4. Site administrators should determine whether the plugin is present and document its current version.

The CVSS score of 5.3 indicates a moderate level of severity, and the EPSS score of less than 1% suggests that the likelihood of exploitation at present is low. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be the plugin’s exposed API endpoints, based on the description that data is retrieved via network requests and that embedded sensitive data can be accessed through these calls. An attacker with web access may be able to retrieve such data without needing authentication, according to the inferred attack path.